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What is claimed is: 

1 . A computing apparatus using SPN structure having 
a plurality of S boxes and a linear converting unit in 

5 an F function, comprising: 

a set of bit numbers inputting unit receiving an 

input of a set T={ t lr t 2 , t 3 t r } of bit numbers obtained 

by unequally dividing all bit numbers of input data to 
be given to the computing apparatus; and 

10 a value indicating existence probability of 

linear converting unit output ting unit output ting a value 
A T indicating an existence probability of an appropriate 
linear converting unit corresponding to a plurality of 
S boxes of which input and output bit numbers are 

15 equivalent to the divided bit numbers. 

2. The computing apparatus according to claim 1, 
wherein said value indicating existence probability of 
linear converting unit outputting unit comprises a 

20 minimum value determining unit obtaining a minimum value 

u k (k=l, 2, r) of a sum of elements of a set formed 

by selecting optional k elements from elements of the 
set T, and a maximum value determining unit obtaining 
a maximum value v k (k=l, 2, 3, r) of a sum of elements 

25 of a set formed by selecting optional k elements from 
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elements of the set T, wherein 

a value obtained by subtracting a maximum value 
of k' that satisfies u k ^v k .(k'=0, 1, . .., r, v 0 =0) for 
a value k, from k is set as w k (k=l, 2, r) , and the 

5 value A T is obtained by subtracting a maximum value of 

w k from a value of (r+1) . 

3. The computing apparatus according to claim 1, 
further comprising: 
10 a linear converting unit existence determining 

unit determining whether the vale A T is positive, and 
determining that the appropriate linear converting unit 
is present when the value is positive. 

15 4. The computing apparatus according to claim 2, 

further comprising: 

a linear converting unit existence determining 
unit determining whether the value A T is positive, and 
determining that the appropriate linear converting unit 

20 is present when the value is positive. 

5. The computing apparatus according to claim 3, 
further comprising: 

a pseudo MDS matrix forming unit forming as the 
25 linear convertingunit, apseudoMDSmatrix corresponding 



58 



to an MDS matrix in a case where the bits are unequally 
divided when it is determined that the linear converting 
unit is present. 

5 6. The computing apparatus according to claim 4, 

further comprising: 

a pseudo MDS matrix forming unit forming as the 
linear converting unit, a pseudoMDS matrix corresponding 
to an MDS matrix in a case where the bits are unequally 
10 divided when it is determined that the linear converting 

unit is present. 

7. The computing apparatus according to claim 5, 
wherein the pseudo MDS matrix forming unit sets a matrix 

15 M of r columns and r rows to M= (M ± j ) (i=l, 2, . . . , r, j = l, 
2, . . ., r) while setting as an element a partial matrix 
M X j of ti columns and tj rows of which an element is 0 
or 1, obtains c (e) =e+r-A T +l for each positive number from 
e=l to (At-1), obtains a set Ti={tii, t i2 , t ie } formed 

20 by optionally selecting e elements from elements of the 

set T and a set T 2 ={ tji, tj 2r • • • , t DC(e ) } formed by optionally 
selecting c(e) elements from elements of the set T, and 
obtains a matrix M such that a value of a small matrix 
of an optional matrix M corresponding to the set (Ti, 

25 T 2 ) and a value of a rank of a small matrix of an optional 
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matrix M corresponding to the set (T 2 , Ti) is equal to 
either a column number of a small matrix of the matrix 
M or a number of ranks of a small matrix of a matrix 
M. 

5 

8. The computing apparatus according to claim 5, 
wherein the pseudo MDS matrix forming unit sets a matrix 
M of r columns and r rows to M= (Mij ) ( i=l , 2 , . . . , r, j = l, 
2, r) while setting as an element a partial matrix 

10 Mij of ti columns and tj rows of which an element is 0 

or 1, obtains c (e) =e+r-A T +l for each positive number from 
e=l to (A T -1) , obtains a set Ti={tii, t i2 , . . . , t ie } formed 
by optionally selecting e elements from elements of the 
set T and a set T 2 ={ tji, t j2 , . . . , t jC (e) } formed by optionally 

15 selecting c(e) elements from elements of the set T, and 

obtains a matrix M such that a value of a small matrix 
of an optional matrix M corresponding to the set (Ti, 
T2) and a value of a rank of a small matrix of an optional 
matrix M corresponding to the set (T 2 , Ti) is equal to 

20 either a column number of a small matrix of the matrix 

M or a number of ranks of a small matrix of a matrix 
M. 

9. The computing apparatus according to claim 7, 
25 wherein a small matrix corresponding to the sets (Ti, 
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T 2 ) is conf iguredby apartialmatrixdesignatedby columns 
respectively corresponding to the tu, t i2/ . .., t le and 
rows respectively corresponding to the t 3 i, tj 2 , . .., t 3C (eu 
among partial matrixes that function as elements 
5 of the r columns and r rows to conf igure the matrix M= (M l3 ) . 

10. The computing apparatus according to claim 8, 
wherein a small matrix corresponding to the sets (Ti, 
T 2 ) is conf iguredby apartialmatrixdesignatedby columns 
10 respectively corresponding to the tu, t i2 , . .., t ie and 

rows respectively corresponding to the tji, tj 2 , tj C (e>/ 
among partial matrixes Mij that function as elements 
of the r columns and r rows to configure the matrixM= (Mij ) . 

15 11. A computation method using SPN structure having 

a plurality of S boxes and a linear converting unit in 
an F function, comprising: 

receiving an input of a set T={ti, t 2 , t 3 . . . t r } 
of bit numbers obtained by unequally dividing all bit 

2 0 numbers of input data to be given; and 

outputting a value A T indicating an existence 
probability of an appropriate linear converting unit 
corresponding to a plurality of S boxes of which input 
and output bit numbers are equivalent to the divided 

25 bit numbers. 
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12 . The computation method using SPN structure having 
an F function according to claim 1, comprising: 

determining whether the vale A T is positive or not; 

5 and 

determining that the appropriate linear 
converting unit is present when the value is positive. 

13. The computation method according to claim 12, 
10 wherein a pseudoMDS matrix corresponding to anMDS matrix 

in a case where the bits are equally divided is formed 
as the linear converting unit. 

14. A computer-readable portable recording medium 
15 used by a computer executing a computation process using 

SPN structure having a plurality of S boxes and a linear 
converting unit in an F function, storing a program for 
causing the computer to perform, comprising: 

receiving an input of a set T={ti, t 2 , t 3 , ... t r } 

20 of bit numbers obtained by unequally dividing all bit 

numbers of input data to be given; and 

outputting a value A T indicating an existence 
probability of an appropriate linear converting unit 
corresponding to a plurality of S boxes of which input 

25 and output bit numbers are equivalent to the divided 
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bit numbers . 

15. A computing apparatus in which Feistel structure 
and SPN structure are combined, receiving data input 

5 and setting a computation result for the data input as 

a data output, wherein 

at least one first data converting units that 
perform data conversion using the Feistel structure, 
and at least one second data converting units that 
10 perform data conversion using the SPN structure are 
continuously combined between the data input and the 
data out. 

16. The computing apparatus according to claim 15, 
15 wherein the SPN structure comprises a nonlinear 

converting unit having an input/output bit number 
obtained by dividing a block length of one block of the 
data input by a word length, and a liner converting unit 
that uses interleaving conversion. 

20 

17. The computing apparatus according to claim 15, 
comprising: 

a nonlinear converting unit having a probability 
0 that for a set of input data in which a differential 
25 appears only on at least one fixed input bit among input 
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bits to the nonlinear converting unit, a differential 
appears for a set of output data in which a differential 
appears on at least one fixed output bits located at 
the same location as at least one fixed input bits, and 
5 further a probability 1/2 that an optional linear 

relational equation only related to at least one fixed 
output bits and at least one fixed output bits, realizes 
between all the input data and output data 1/2, is provided, 
as a nonlinear converting unit configuring the SPN 
10 structure. 

18. The computing apparatus according to claim 16, 
comprising : 

a nonlinear converting unit having a probability 
15 0 that for a set of input data in which a differential 

appears only on at least one fixed input bit among input 
bits to the nonlinear converting unit, a differential 
appears for a set of output data in which a differential 
appears on at least one fixed output bits located at 
20 the same location as at least one fixed input bits, and 

further a probability 1/2 that an optional linear 
relational equation only related to at least one fixed 
output bits and at least one fixed output bits, realizes 
between all the input data and output data 1/2, is provided, 
25 as a nonlinear converting unit configuring the SPN 
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structure . 

19 A computation method in which Feistel structure 
and SPN structure are combined, receiving a data input 
5 and setting a computation result for the data input as 

a data output, wherein 

at least one piece of first data conversion that 
performs data conversion using the Feistel structure 
and at least one piece of second data conversion that 
10 performs data conversion using the SPN structure are 
combined to be executed between the data input and the 
data output . 

20. The computation method in which the Feistel 
15 structure and the SPN structure are combined according 

to claim 19, wherein 

in first data conversion using the SPN structure, 

nonlinear conversion of which a number of input bits 

and a number of output bits are equivalent to a value 
20 obtained by dividing a block length of one block of a 

data input by a word length, and 

liner conversion that uses interleaving 

conversion, are executed. 
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21 . The computing method in which the Feistel structure 
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and the SPN structure are combined according to claim 

19, wherein 

nonlinear conversion having a probability 0 that 
for a set of input data in which a differential appears 
5 only on at least one fixed input bit among input bits 

to be used for the nonlinear conversion, a differential 
appears for a set of output data in which a differential 
appears on at least one fixed output bits located at 
the same location as the at least one fixed input bits, 

10 and further having a probability 1/2 that an optional 

linear relational equation only related to the at least 
one fixed input bits and the at least one fixed output 
bits is realized between all the input data and output 
data, is executed as nonlinear conversion to be executed 

15 in the SPN structure. 

22 . The computingmethod in which the Feistel structure 
and the SPN structure are combined according to claim 

20, wherein 

20 nonlinear conversion having a probability 0 that 

for a set of input data in which a differential appears 
only on at least one fixed input bit among input bits 
to be used for the nonlinear conversion, a differential 
appears for a set of output data in which a differential 

25 appears on at least one fixed output bits located at 
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the same location as the at least one fixed input bits, 
and further having a probability 1/2 that an optional 
linear relational equation only related to the at least 
one fixed input bits and the at least one fixed output 
5 bits is realized between all the input data and output 

data, is executed as nonlinear conversion to be executed 
in the SPN structure. 

23. A portable computer-readable recording medium 
0 being used for a computer that executes computation of 

receiving data input and that sets a computation result 
for the input data as a data output, and storing a program 
causing the computer to perform, comprising: 

combining and executing at least one piece of first 
5 data conversion that performs data conversion using 

Feistel structure; and at least one piece of second data 
conversion that performs data conversion using SPN 
structure between the data input and the data output. 

0 24. A computing apparatus using SPN structure having 

a plurality of S boxes and a linear converting unit in 
an F function, comprising: 

set of bit numbers inputting means for receiving 
an input of a set T={ti, t 2 , t 3 . . . t r } of bit numbers 

5 obtained by unequally dividing all bit numbers of input 
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data to be given to the computing apparatus; an 

value indicating existence probability of linear 
converting unit outputting means for outputting a value 
A T indicating an existence probability of an appropriate 
5 linear converting unit corresponding to a plurality of 

S boxes of which input and output bit numbers are 
equivalent to the divided bit numbers. 

25 A computing apparatus in which Feistel structure 
10 and SPN structure are combined, for receiving a data 

input, and setting a computation result for the data 

input as a data output, comprising: 

at least one first data converting means for 

performing data conversion using the Feistel structure; 
15 and 

at least one second data converting means for 
performing data conversion using the SPN structure, 

wherein said first data converting means and said 
second data converting means are continuously combined 
20 between the data input and the data output. 



